OFFICE OF THE CHIEF OF POLICE 


SPECIAL ORDER NO. 11 March 5, 2008 

SUBJECT: REPORTING INCIDENTS POTENTIALLY RELATED TO FOREIGN OR 

DOMESTIC TERRORISM 

PURPOSE: Current anti-terrorism philosophy embraces the concept 

that America's 800,000 law enforcement officers fill a 
critical position in the area of terrorism prevention. Law 
enforcement authorities must carry out their counter-terrorism 
responsibilities within the broader context of their core 
mission of providing emergency and non-emergency services in 
order to prevent crime, violence and disorder. In support of 
this, the Department's Counter-Terrorism and Criminal 
Intelligence Bureau (CTCIB) is engaging in an effort to more 
thoroughly gather, analyze and disseminate information and 
observations, of either a criminal or suspicious nature, which 
may prove critical to the intelligence cycle. 

This Order establishes Department policy for investigating and 
reporting crimes and non-criminal incidents that represent 
indicators of potential foreign or domestic terrorism, and 
incorporates within the Department Manual a procedure for 
gathering and maintaining information contained in such reports. 

POLICY: It is the policy of the Los Angeles Police Department 

to make every effort to accurately and appropriately 
gather, record and analyze information, of a criminal or non¬ 
criminal nature, that could indicate activity or intentions 
related to either foreign or domestic terrorism. These efforts 
shall be carried out in a manner that protects the information 
privacy and legal rights of Americans, and therefore such 
information shall be recorded and maintained in strict 
compliance with existing federal, state and Department 
guidelines regarding Criminal Intelligence Systems (28 Code of 
Federal Regulations (CFR), Part 23 and applicable California 
State Guidelines). 

PROCEDURE: 

I. DEFINITIONS. 

A. Suspicious Activity Report. A Suspicious Activity 
Report (SAR) is a report used to document any 
reported or observed activity, or any criminal act 
or attempted criminal act, which an officer believes 
may reveal a nexus to foreign or domestic terrorism. 
The information reported in a SAR may be the result 
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of observations or investigations by police 
officers, or may be reported to them by private 
parties. 

Incidents which shall be reported on a SAR are as 
follows: 

* Engages in suspected pre-operational surveillance 
(uses binoculars or cameras, takes measurements, 
draws diagrams, etc.) 

* Appears to engage in counter-surveillance efforts 
(doubles back, changes appearance, evasive 
driving, etc.); 

* Engages security personnel in questions focusing 
on sensitive subjects (security information, 
hours of operation, shift changes, what security 
cameras film, etc.); 

* Takes measurements (counts footsteps, measures 
building entrances or perimeters, distances 
between security locations, distances between 
cameras, etc.); 

* Takes pictures or video footage (with no apparent 
esthetic value, i.e. camera angles, security 
equipment, security personnel, traffic lights, 
building entrances, etc.); 

* Draws diagrams or takes notes (building plans, 
location of security cameras or security 
personnel, security shift changes, notes of weak 
security points, etc.); 

* Abandons suspicious package or item (suitcase, 
backpack, bag, box, package, etc.); 

* Abandons vehicle (in a secured or restricted 
location i.e. the front of a government building, 
airport, sports venue, etc.); 

* Attempts to enter secured or sensitive premises 
or area without authorization (i.e. "official 
personnel," closed off areas of airport, harbor, 
secured areas at significant events such as 
appearances by politicians, etc) ; 

* Engages in test of existing security measures 
(i.e. "dry run", security breach of perimeter 
fencing, security doors, etc., creating false 
alarms in order to observe reactions, etc.); 

* Attempts to smuggle contraband through access 
control point (airport screening centers. 



SPECIAL ORDER NO. 11 


3 


March 5, 2008 


security entrance points at courts of law, sports 
games, entertainment venues, etc.); 

* Makes or attempts to make suspicious purchases, 
such as large amounts of otherwise legal 
materials (i.e. pool chemicals, fuel, fertilizer, 
potential explosive device components, etc); 

* Attempts to acquire sensitive or restricted items 
or information (plans, schedules, passwords, 

etc) ; 

* Attempts to acquire illegal or illicit explosives 
or precursor agents; 

* Attempts to acquire illegal or illicit chemical 
agent (nerve agent, blood agent, blister agent, 
etc.); 

* Attempts to acquire illegal or illicit biological 
agent (anthrax, ricen, Eboli, small pox, etc.); 

* Attempts to acquire illegal or illicit 
radiological material (uranium, plutonium, 
hospital x-ray discards, etc.); 

* In possession, or utilizes, explosives (for 
.illegal purposes) ; 

* In possession, or utilizes, chemical agent (for 
.illegal purposes, i.e. dry ice bomb, chlorine, 
phosgene, WMD attack, etc) ; 

* In possession, or utilizes, biological agent (for 
illegal purposes, i.e. terrorist device, WMD or a 
tool of terrorism, etc.); 

* In possession, or utilizes, radiological material 
(for illegal purposes, i.e. as a weapon, etc.); 

* Acquires or attempts to acquire uniforms without 
a legitimate cause (Service personnel, government 
uniforms, etc); 

* Acquires or attempts to acquire official or 
official-appearing vehicle without a legitimate 
cause (i.e. emergency or government vehicle, 
etc.); 

* Pursues specific training or education which 
indicate suspicious motives (flight training, 
weapons training, etc); 

* Stockpiles unexplained large amounts of currency; 

* In possession of multiple passports, 
identifications or travel documents issued to the 
same person; 

* Espouses extremist views (verbalizes support of 
terrorism, incites or recruits others to engage 
in terrorist activity, etc.); 
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* Brags about affiliation or membership with 
extremist organization ("white power", militias, 
KKK, etc.); 

* Engages in suspected coded conversations or 
transmissions (i.e. email, radio, telephone, 
etc., i.e. information found during a private 
business audit is reported to police); 

* Displays overt support of known terrorist 
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* In possession of coded or ciphered literature or 
correspondence. 

B. Involved Party (IP) . An involved party (IP) is an 
individual that has been observed engaging in 
suspicious activity of this nature, when no 
definitive criminal activity can be identified, thus 
precluding their identification as a suspect. 
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II. REPORTING AND INVESTIGATING. 

A. Employees - Responsibilities. Any Department 
employee receiving any information regarding 
suspicious activity of this nature shall: 

* Investigate and take appropriate action, to 
include any tactical response or notifications 
to specialized entities. 

Note: This section does not preclude, in any 

way, an employee taking immediate action during 
the commission of a criminal act, or in 
circumstances which require the immediate defense 
of life, regardless of the nature or origin. 

* If the activity observed is not directly related 
to a reportable crime, officers shall record the 
information collected from the person reporting, 
or their own observations, on an Investigative 
Report (IR), Form 03.01.00, titled "Suspicious 
Activity" in accordance with the following 
guidelines: 

* If the person reporting (R) is willing to be 
contacted by investigators, they shall be 
listed within the Involved Persons portion of 
the IR. Officers shall consider utilizing a 
"Request for Confidentiality of Information," 
Form 03.02.00, to ensure confidentiality. If 
absolutely necessary, officers can enter 
"Anonymous" for person reporting. Any desire 
by a person reporting to remain anonymous does 
not exempt officers from the requirement to 
complete an IR. 

* If the potential target of the activity can 
be identified, such as a government building 
or official being surveilled, that location or 
individual shall be listed within the "Victim" 
portion of the IR. Otherwise the "City of Los 
Angeles" shall be listed as the victim. 

* If the information includes an involved 
party(IP), officers shall identify or fully 
describe IPs within the narrative (page 2) of 
their report, along with any vehicle 
descriptions or other pertinent information. 
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* If the information is related to a regular 
criminal investigation (such as a bomb threat, 
criminal threats, trespassing, etc.), the 
officers shall complete the criminal 
investigation, make any appropriate arrests 
and complete any related reports. The 
officers shall include any additional 
information that provides the nexus to 
terrorism within the narrative of the crime or 
arrest report. 

* Should officers come across information that 
indicates possible terrorism-related activity 
while investigating an unrelated crime or 
incident (e.g., such as officers conducting a 
domestic violence investigation observe 
possible surveillance photographs and a map of 
the region surrounding a government facility), 
or should they conduct an impound or found 
property investigation which is suspicious in 
nature, the officers shall make no mention of 
this potential terrorism-related material or 
activity within the impound, property, crime 
or arrest report. Under these circumstances, 
the officers shall complete a separate SAR in 
addition to the crime or arrest report, and 
shall note the criminal investigation, impound 
or found property investigation as their 
source of their activity. 

* Officers shall note on the left margin of any 
arrest facesheet or IR that the report is to 
be sent to CTCIB, Major Crimes Division. 

Note: The Investigative Report is currently 

being revised to include "SAR" and "Original 
to CTCIB, Major Crimes Division" boxes to be 
checked when appropriate. The revised IR will 
also include additional entries for involved 
parties and involved vehicles. 

* Notify Major Crimes Division (contact Real- 
Time Analysis and Critical Response [RACR] 
Division for off hours notification) for 
guidance or if the report involves an arrest 
or a crime with follow-up potential. 

* Notify the Watch Commander, Area of 


occurrence. 
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* Upon approval by the Watch Commander, ensure 
the Area Records Unit is made aware of the 
report, immediately assigns a DR number and 
forwards the original report to MCD. 

Note: Nothing in this Order alters existing 

policies regarding notifications to required 
specialized units such as Bomb Squad, 

Hazardous Materials Unit, Criminal Conspiracy 
Section or RACR Division. 

B. Hazardous Materials and Devices Section, Emergency 
Services Division - Responsibility. Personnel 
assigned to the Bomb Squad, Hazardous Materials/ 
Environmental Crimes, or Airport K-9 Bomb Detection 
Unit shall ensure that a SAR is completed on all 
incidents on which they respond where a potential 
nexus to terrorism exists. Suspicious Activity 
Reports completed by personnel assigned to these 
units shall be processed through a geographic Area 
Records Unit as directed below. 

C. Watch Commanders - Responsibilities. Upon 
notification that officers have received information 
regarding suspicious activity, the Watch Commander 
shall:: 

* Ensure the information supports the completion of 
a SAR report and that no greater law enforcement 
response or notifications to MCD are currently 
needed; 

* Review the report for completeness; and, 

* Ensure the Area Records Unit immediately assigns 
a DR Number and forwards the original report to 
MCD. 

D. Major Crimes Division - Responsibility. Upon 
receiving a telephonic notification of suspicious 
activity, MCD personnel shall, when appropriate, 
conduct immediate debriefs of arrestees, or provide 
the appropriate guidance to patrol officers. Upon 
receiving a SAR report forwarded to MCD, assigned 
personnel shall follow established protocols 
regarding the processing of such information. 



SPECIAL ORDER NO. 11 


8 


March 5, 2008 


E. Records Personnel - Responsibilities. Upon receipt 
of a SAR-related incident, crime or arrest report, 
records personnel shall: 

* Enter the information into the CCAD system, 
including any appropriate CTCIB-related codes; 
and, 

* Send the original .report to "CTCIB/Major Crimes 
Division, Stop 1012" as soon as practicable, but 
no later than 24 hours after the report is taken. 
No copies of the report shall be maintained at 
the Area . 

F. Area Detectives Personnel - Responsibilities. Upon 
receipt of a SAR-related crime or arrest report Area 
detectives shall; 

* Ensure the report has been screened by MCD 
personnel and referred back to the geographic 
Area for investigation; and, 

* Complete the investigation per normal policies 
and guidelines. 

Note: If the report is a SAR-related incident 

only, or a crime or arrest report which arrives 
at an Area Detective Division without having been 
reviewed by MCD personnel. Area detectives shall 
immediately forward the report to MCD (no copies 
shall be retained at the Area). 

G. Counter-Terrorism and Criminal Intelligence Bureau - 
Responsibility. Counter-Terrorism and Criminal 
Intelligence Bureau (CTCIB) is responsible for 
providing Department personnel with training 
pertaining to the proper handling of suspected 
terrorism-related activity and ensuring adherence to 
the guidelines established regarding developmental 
information and intelligence systems. 
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AMENDMENTS: This Order adds section 4/271.46 to the Department 

Manual. 

AUDIT RESPONSIBILITY: The Commanding Officer, Counter Terrorism 
and Criminal Intelligence Bureau, shall monitor compliance with 
this directive in accordance with Department Manual Section 
0/080.30 and shall ensure that all information is collected and 
maintained in strict compliance with existing federal. State and 
Department guidelines regarding Criminal Intelligence Systems 
(28 C.F.R., Part 23 and applicable California State Guidelines). 


WILLIAM J. BRATTON 
Chief of Police 

DISTRIBUTION "D" 



